A two-week focused sandbox bug-bounty program resulted in 1,285 filings, but none that could access customer data.
The Vercel sandbox, a Firecracker‑based microVM environment, is an isolation tool for untrusted AI‑agent code. For two weeks (August 18 until September 1), Vercel operated a focused bug-bounty program with a $1 million reward pot. It called the program a ‘challenge’ – a challenge to HackerOne hackers (black box targeting) and Trail of Bits engineers (white box targeting) to escape the sandbox.
Time is up, and the results have been published. Vercel received 1,285 reports in two weeks, demonstrating the modern power and speed of researchers working with AI-assistance. “Report triage runs until October 1, but so far we have validated 1 Critical, 7 High, 15 Medium, 49 Low, 19 Informative. ~$325k in committed payouts,” says the firm. None of the reports showed anyone being able to access a real customer’s data – but many have allowed Vercel to improve the product.
The most important filing found two independent defects in the Linux kernel’s networking stack (not Vercel’s own code). One leaks memory from the host’s kernel, while the other crashes the host, deterministically. These flaws have wide implications since many major cloud providers isolate customer workloads using the same layer of the Linux kernel. Because of the bounty, Vercel learned about the flaws two weeks ahead of the kernel maintainers.
“The fixes are under private review and CVEs are pending, so we are keeping details out of this post until they are public,” reports Vercel.
The white box testing by two Trail of Bits engineers produced 20 findings; but Vercel got most value from their architectural advice. While agreeing with Vercel’s choice of the virtualization, they made three structural recommendations; for example, ’stop trusting the guest’.
“Our control plane accepted values returned by software running inside the microVM. Every one of those values is tenant input. Anything that crosses the boundary should be derived server-side or signed with a key the guest cannot reach,” explains Vercel.